NIST CSF 2.0 · Feb 2024

NIST Cybersecurity Framework 2.0

Interactive implementation checklist for NIST CSF 2.0. Six functions with all categories and subcategories. Track your maturity — progress saved in your browser.

GV Govern

ID Identify

PR Protect

DE Detect

RS Respond

RC Recover

0%0/106 controls implemented

GV — Govern: 0/31

ID — Identify: 0/21

PR — Protect: 0/22

DE — Detect: 0/11

RS — Respond: 0/13

RC — Recover: 0/8

GV.OC-01Organisational mission understoodHigh

Organisational mission and commitments, how cybersecurity supports the mission, are understood by the organisation's leadership and personnel.

GV.OC-02Internal and external factors identifiedHigh

Internal and external factors that affect the organisation's cybersecurity risk and the achievement of the organisation's mission are identified and understood.

GV.OC-03Legal and regulatory requirementsHigh

Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed.

GV.OC-04Stakeholder expectationsMed

Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organisation are understood and communicated.

GV.OC-05Risk outcomes communicatedMed

Outcomes, capabilities, and services that the organisation depends on are understood and communicated to senior leaders.

GV.RM-01Risk management objectives establishedHigh

Risk management objectives are established and agreed to by organisational stakeholders.

GV.RM-02Risk appetite determinedHigh

Risk appetite and risk tolerance statements are established, communicated, and maintained.

GV.RM-03Cybersecurity risk and organisational risk integratedHigh

Organisational cybersecurity risk management is integrated into enterprise risk management.

GV.RM-04Strategic direction communicatedMed

Strategic direction that describes appropriate risk response options is established and communicated.

GV.RM-05Lines of communication establishedMed

Lines of communication across the organisation are established for cybersecurity risks, including risks from suppliers and other third parties.

GV.RM-06Standardised risk response optionsMed

A standardised method for calculating, documenting, categorising, and prioritising cybersecurity risks is established and communicated.

GV.RM-07Strategic opportunities consideredLow

Strategic opportunities (i.e., positive risks) are characterised and are included in organisational cybersecurity risk discussions.

GV.RR-01Leadership accountabilityHigh

Organisational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.

GV.RR-02Roles and responsibilities establishedHigh

Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.

GV.RR-03Adequate resources providedHigh

Adequate resources are allocated commensurate with cybersecurity risk strategy, roles, responsibilities, and policies.

GV.RR-04Cybersecurity risk management expertise availableMed

Cybersecurity is included in human resources practices.

GV.PO-01Policy establishedHigh

Policy for managing cybersecurity risks is established based on organisational context, cybersecurity strategy, and priorities and is communicated and enforced.

GV.PO-02Policy reviewed and updatedHigh

Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organisational mission.

GV.OV-01Cybersecurity review conductedHigh

Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.

GV.OV-02Cybersecurity risk and performance reviewedMed

The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organisational requirements and risks.

GV.OV-03Outcomes reviewedMed

Organisational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.

GV.SC-01C-SCRM programme establishedHigh

A cybersecurity supply chain risk management programme, strategy, objectives, policies, and processes are established and agreed to by organisational stakeholders.

GV.SC-02Cybersecurity role of suppliersHigh

Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally.

GV.SC-03Supply chain cybersecurity practices assessedMed

Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.

GV.SC-04Suppliers included in planningHigh

Suppliers are known and prioritised by criticality.

GV.SC-05Requirements in supplier agreementsHigh

Requirements to address cybersecurity risks in supply chains are established, prioritised, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.

GV.SC-06Planning and due diligence performedHigh

Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.

GV.SC-07Supply chain security practices evaluatedHigh

The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritised, assessed, responded to, and monitored over the course of the relationship.

GV.SC-08Relevant suppliers treated with appropriate priorityMed

Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.

GV.SC-09Integrity checking mechanisms usedMed

Supply chain security practices are integrated into cybersecurity and enterprise risk management programmes, and their performance is monitored throughout the technology product and service life cycle.

GV.SC-10Cybersecurity supply chain risk management planLow

Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.

ID.AM-01Inventories of hardware maintainedHigh

Inventories of hardware managed by the organisation are maintained.

ID.AM-02Inventories of software maintainedHigh

Inventories of software, services, and systems managed by the organisation are maintained.

ID.AM-03Network representations maintainedHigh

Representations of the organisation's authorised network communication and internal and external network data flows are maintained.

ID.AM-04Inventories of services maintainedMed

Inventories of services provided by suppliers are maintained.

ID.AM-05Assets prioritised by criticalityHigh

Assets are prioritised based on classification, criticality, resources, and impact on the mission.

ID.AM-07Inventories of data and PII maintainedHigh

Inventories of data and corresponding metadata for designated data types are maintained.

ID.AM-08Systems, hardware, software, services, and data inventories managed through their life cyclesMed

Systems, hardware, software, services, and data are managed throughout their life cycles.

ID.RA-01Vulnerabilities in assets identifiedHigh

Vulnerabilities in assets are identified, validated, and recorded.

ID.RA-02Cyber threat intelligence receivedHigh

Cyber threat intelligence is received from information sharing forums and sources.

ID.RA-03Internal and external threats identifiedHigh

Internal and external threats to the organisation are identified and recorded.

ID.RA-04Potential impacts and likelihoods determinedHigh

Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.

ID.RA-05Threats, vulnerabilities, likelihoods, and impacts used to understand inherent riskHigh

Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritisation.

ID.RA-06Risk responses chosen, prioritised, planned, tracked, and communicatedHigh

Risk responses are chosen, prioritised, planned, tracked, and communicated.

ID.RA-07Changes and exceptions managedMed

Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.

ID.RA-08Processes for receiving, analysing, and responding to vulnerability disclosures establishedMed

Processes for receiving, analysing, and responding to vulnerability disclosures are established.

ID.RA-09Authenticity and integrity of hardware and software verifiedMed

The authenticity and integrity of hardware and software are evaluated prior to acquisition and use.

ID.RA-10Critical suppliers assessedMed

Critical suppliers are assessed prior to acquisition.

ID.IM-01Improvements identified from evaluationsMed

Improvements are identified from evaluations.

ID.IM-02Improvements identified from security tests and exercisesMed

Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.

ID.IM-03Improvements identified from execution of operational processesMed

Improvements are identified from execution of operational processes, procedures, and activities.

ID.IM-04Incident response plans and other cybersecurity plans reviewed and updatedHigh

Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved.

PR.AA-01Identities and credentials for authorised users, services, and hardware managedHigh

Identities and credentials for authorised users, services, and hardware are managed by the organisation.

PR.AA-02Identities are proofed and bound to credentialsHigh

Identities are proofed and bound to credentials based on the context of interactions.

PR.AA-03Users, services, and hardware are authenticatedHigh

Users, services, and hardware are authenticated.

PR.AA-04Identity assertions are protectedHigh

Identity assertions are protected, conveyed, and verified.

PR.AA-05Access permissions and authorisations managedHigh

Access permissions, entitlements, and authorisations are managed, incorporating the principles of least privilege and separation of duties.

PR.AA-06Physical access to assets managedHigh

Physical access to assets is managed, monitoring access to prevent unauthorised access.

PR.AT-01Personnel are provided awareness and trainingHigh

Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.

PR.AT-02Individuals in specialised roles provided awareness and trainingHigh

Individuals in specialised roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind.

PR.DS-01Data-at-rest are protectedHigh

The confidentiality, integrity, and availability of data-at-rest are protected.

PR.DS-02Data-in-transit are protectedHigh

The confidentiality, integrity, and availability of data-in-transit are protected.

PR.DS-10Data-in-use are protectedHigh

The confidentiality, integrity, and availability of data-in-use are protected.

PR.DS-11Backups of data are created, protected, maintained, and testedHigh

Backups of data are created, protected, maintained, and tested.

PR.PS-01Configuration management practices establishedHigh

Configuration management practices are established and applied.

PR.PS-02Software is maintained, replaced, and removed commensurate with riskHigh

Software is maintained, replaced, and removed commensurate with risk.

PR.PS-03Hardware is maintained, replaced, and removed commensurate with riskMed

Hardware is maintained, replaced, and removed commensurate with risk.

PR.PS-04Log records are generated and made availableHigh

Log records are generated and made available for continuous monitoring.

PR.PS-05Installation and execution of unauthorised software is preventedHigh

Installation and execution of unauthorised software is prevented.

PR.PS-06Secure software development practices integratedHigh

Secure software development practices are integrated, and their security is evaluated.

PR.IR-01Networks and environments protected from unauthorised logical accessHigh

Networks and environments are protected from unauthorised logical access and usage.

PR.IR-02Organisation's technology assets are protected from environmental threatsMed

The organisation's technology assets are protected from environmental threats.

PR.IR-03Mechanisms for achieving resilience requirementsHigh

Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.

PR.IR-04Adequate resource capacityMed

Adequate resource capacity to ensure availability is maintained.

DE.CM-01Networks are monitoredHigh

Networks and network services are monitored to find potentially adverse events.

DE.CM-02Physical environment monitoredMed

The physical environment is monitored to find potentially adverse events.

DE.CM-03Personnel activity and technology usage are monitoredHigh

Personnel activity and technology usage are monitored to find potentially adverse events.

DE.CM-06External service provider activity is monitoredHigh

External service provider activities and services are monitored to find potentially adverse events.

DE.CM-09Computing hardware and software monitoredHigh

Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.

DE.AE-02Potentially adverse events are analysedHigh

Potentially adverse events are analysed to better understand associated activities.

DE.AE-03Information is correlated from multiple sourcesHigh

Information is correlated from multiple sources.

DE.AE-04Impact of adverse events is estimatedHigh

The estimated impact and scope of adverse events are understood.

DE.AE-06Information on adverse events is provided to authorised staffHigh

Information on adverse events is provided to authorised staff and tools.

DE.AE-07Cyber threat intelligence and other contextual information integrated into analysisMed

Cyber threat intelligence and other contextual information are integrated into the analysis.

DE.AE-08Incidents are declared when adverse events meet criteriaHigh

Incidents are declared when adverse events meet the defined incident criteria.

RS.MA-01Incident response plan is executedHigh

The incident response plan is executed in coordination with relevant third parties once an incident is declared.

RS.MA-02Incidents are triagedHigh

Incidents are triaged to prioritise response activities.

RS.MA-03Incidents are categorised and escalatedHigh

Incidents are categorised and escalated consistent with the response plan.

RS.MA-04Incidents are responded toHigh

Incidents are responded to consistent with plans and policies.

RS.MA-05Incidents are closed outHigh

The criteria for initiating incident recovery are applied, and the incident is closed out when those criteria are met.

RS.AN-03Analysis is performed to establish what has taken placeHigh

Analysis is performed to establish what has taken place during an incident and the root cause of the incident.

RS.AN-06Actions performed during investigation are recordedHigh

Actions performed during investigation are recorded, and the records' integrity and provenance are preserved.

RS.AN-07Incident scope is characterisedHigh

Incident scope is characterised to understand the threat actor's target, motivation, and behaviour.

RS.AN-08Strengths and weaknesses of existing controls are identifiedMed

The incident response plan and other cybersecurity plans are reviewed and updated based on new learnings.

RS.CO-02Internal and external stakeholders are notified of incidentsHigh

Internal and external stakeholders are notified of incidents in a timely manner.

RS.CO-03Information is shared with designated internal and external stakeholdersMed

Information is shared with designated internal and external stakeholders.

RS.MI-01Incidents are containedHigh

Incidents are contained.

RS.MI-02Incidents are eradicatedHigh

Incidents are eradicated.

RC.RP-01Recovery plan is executedHigh

The recovery portion of the incident response plan is executed once initiated from the incident response process.

RC.RP-02Recovery actions are selected, scoped, and performedHigh

Recovery actions are selected, scoped, prioritised, and performed.

RC.RP-03The integrity of backups and other restoration assets is verifiedHigh

The integrity of backups and other restoration assets is verified before using them for restoration.

RC.RP-04Critical systems are restored and verifiedHigh

Critical mission functions and cybersecurity services are re-established consistent with the recovery plan.

RC.RP-05Integrity of restored assets is verifiedHigh

The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed.

RC.RP-06End of incident is declaredMed

The end of incident recovery is declared based on criteria, and lessons learned are conducted.

RC.CO-03Recovery activities and progress are communicatedHigh

Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders.

RC.CO-04Public updates are sharedMed

Public updates on incident recovery are shared using approved methods and messaging.

Related Compliance Frameworks

ISO 270012022

International ISMS standard — 93 controls across 4 themes. Widely recognised globally.

CIS Controlsv8

18 prioritised controls in 3 implementation groups. Practical cyber hygiene baseline.

PCI-DSSv4.0

12 requirements for entities handling payment card data. Mandatory for merchants and service providers.

SOC 2Type II

Trust Service Criteria audit covering Security, Availability, Confidentiality, Integrity and Privacy.

CERT-In2022

India mandatory incident reporting: 6-hour reporting window, 180-day log retention, NTP sync.

RBI Cyber Security2023

Reserve Bank of India Master Directions covering cyber risk, SOC requirements and incident reporting.

HIPAASecurity Rule

Administrative, physical and technical safeguards for electronic Protected Health Information (ePHI).

Frequently Asked Questions

What is NIST CSF 2.0?

The 2024 update to the NIST Cybersecurity Framework, a voluntary framework for managing cybersecurity risk applicable to organisations of any size or sector.

What changed from NIST CSF 1.1 to 2.0?

CSF 2.0 added a sixth function, GOVERN, covering organisational context, risk strategy and oversight, and broadened scope beyond critical infrastructure to all organisations.

What are the six functions of NIST CSF 2.0?

GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER.

Is NIST CSF a certification?

No — unlike ISO 27001, there is no formal NIST CSF certification; organisations self-assess maturity and tiers against the framework's categories and subcategories.